Nodes
Any x86-64 or arm64 Linux with systemd that k3s supports (Ubuntu 24.04, Debian 13, Rocky/Alma 9). All nodes on one L2 network for MetalLB, with fixed IPs.
Where the resources go (production defaults):
Builds are the main cost: each one reserves 2 CPUs and 6 GiB until it finishes.
ATOLL_MAX_BUILDS
(default 2) limits builds per server replica, so two replicas run up to four at once.
Storage: k3s’ local-path provisioner keeps volumes on the node that created them. That is fine because
Postgres and SeaweedFS replicate across nodes themselves, and the registry stores its images in SeaweedFS.
Size the SeaweedFS volumes for sources, web apps, artifacts and images together.
DNS
Point these records at the MetalLB IP of Traefik (ingress.loadBalancerIP, or the IP shown by
kubectl -n traefik get svc traefik after install). If the IP is private, forward ports 80 and 443 from your
public IP to it.
Keep the panel and API off the apps domain. The panel’s session cookie lives on the panel host, and
everything under
*.apps.example.com runs user code. If the panel were panel.apps.example.com, any user app
could set or overwrite cookies for it. The chart refuses such a configuration. Best is an apps domain on its
own registrable domain (e.g. example-apps.com next to atoll.example.com), so apps are not even same-site
with the panel.
For the wildcard certificate cert-manager needs API access to the DNS zone of apps.example.com: a Cloudflare
API token with Zone:DNS:Edit, or an RFC2136 server (BIND, Knot, PowerDNS) that accepts TSIG-signed updates.
Users’ custom domains point a CNAME at <project>.apps.example.com (or an A record at the same IP); their
certificates use HTTP-01, so port 80 must be reachable from the internet.
Ports
Outbound, nodes need HTTPS to container registries (ghcr.io, docker.io, quay.io, registry.k8s.io), Let’s
Encrypt, your DNS provider and Maven/Gradle repositories (builds), and S3 access to the backup bucket.
Accounts and tools
- An admin machine with
kubectl,helm4,helmfile1.x,openssland eitherhtpasswd(apache2-utils) or Docker. - An off-site S3 bucket for Postgres backups (Backblaze B2, Cloudflare R2, Wasabi, Hetzner Object Storage…).
- The server and builder images, published to a registry the nodes can pull from.